The D.C. Circuit upheld Roman Sterlingov's convictions and 150-month sentence. The court allowed blockchain-tracing testimony on the trial record, while stressing that Sterlingov had not shown why access to Reactor's source code mattered to his defense.
At trial, prosecutors had to connect Bitcoin Fog's address cluster to Roman Sterlingov himself. On September 25, 2026, the D.C. Circuit upheld his convictions and 150-month sentence, finding that the government's blockchain-tracing methods had been explained and corroborated. The court rejected Sterlingov's challenge over the withheld source code because he had not shown how access to it was material to his defense.
The ruling draws a narrow line. A court can admit expert analysis without requiring disclosure of every software component. The decision does not establish that Chainalysis Reactor is error-free, or that a wallet cluster alone proves who owns funds or committed a crime.
FBI witness Luke Scholl and Chainalysis analyst Elizabeth Bisbee testified that Reactor clustered and attributed more than 900,000 Bitcoin addresses to Bitcoin Fog. The service mixed users' bitcoin to obscure transaction trails.
The witnesses described co-spend clustering, which links addresses used together as inputs in one transaction on the inference that they share control. They also explained behavioral clustering, which compares patterns such as change-address use. Reactor's transaction fingerprints are another part of that analysis. Intelligence-based clustering draws on outside information, including data leaks and court documents. Data partnerships can supply further intelligence.
Separately, TokenPost reported that eight darknet marketplaces sent approximately 80,000 BTC through the mixer. That figure describes activity associated with Bitcoin Fog. It does not establish that all the funds belonged to one owner.
The prosecution offered evidence beyond address clustering. The appellate opinion recounts IP-overlap analysis and Sterlingov's earlier activity involving mixers. It also cites darknet promotion, financial records and Bitcoin Fog's shutdown shortly after his arrest. The government had to connect the evidence to Sterlingov, not simply identify a group of addresses associated with the service.
That distinction matters when reading blockchain analytics. A service may control addresses holding funds for many customers. Attribution to a service does not automatically identify an address user, establish who owns customer funds or show that a particular person operated the service.
Federal Rule of Evidence 702 requires the party offering an expert to show that the testimony is more likely than not to help the fact-finder. The testimony must rest on sufficient data. It must also use reliable methods and apply them reliably to the case. The appellate panel said Daubert's reliability factors are flexible, not a mandatory checklist. Those factors include testing and peer review. Error rates and general acceptance also matter. The panel reviewed the trial judge's decision for abuse of discretion, giving the judge latitude in assessing the reliability inquiry and its result.
Reactor's witnesses acknowledged that the software had not been peer-reviewed. They did not know its error rate. The court nevertheless cited the witnesses' experience and their explanations of the methods. It also pointed to the software's use by law enforcement and private-sector specialists. Comparisons with information obtained later through legal processes, along with corroborating evidence, further supported admission. The ruling concerns whether this testimony could be admitted on this record. It does not certify Reactor as universally accurate.
The numerical checks cited in the opinion come with limits. A government contractor reportedly confirmed that Reactor correctly clustered and attributed 99.9% of a large group of addresses in another case. The opinion did not provide a complete public sampling design. That figure applies to the cited group in that case, not to a product-wide error rate.
Scholl separately tested five known Bitcoin Fog addresses used in undercover transactions. Four appeared in Reactor's cluster. Sterlingov called the missing address a 20% error rate. The panel accepted the trial court's distinction between a conservative, underinclusive cluster and a false positive that wrongly assigns an unrelated address.
The district court ordered Reactor's heuristics and underlying assumptions disclosed to Sterlingov's counsel and qualified experts under a protective order. It restricted Sterlingov's personal access because of concerns that disclosure could help someone evade tracing. The panel also noted that Sterlingov's experts declined to review the materials, whatever the protective order allowed. None of those disclosures amounted to access to Reactor's source code.
The appeals court said the district judge repeatedly asked Sterlingov to explain why the code was material and relevant to his defense. He did not provide that explanation. The judge had indicated a willingness to provide the code if Sterlingov showed a justified need. His newly raised constitutional arguments over access to the full software, including its code, received plain-error review because he had not presented them below.
The panel also rejected Sterlingov's Confrontation Clause theory that machine-generated outputs required disclosure of the source code. It considered his argument that human programming choices shaped the system's inferences.
His due-process arguments faced separate obstacles. Sterlingov's opening appellate brief did not challenge the denial of his Rule 17(c) subpoena request. The panel therefore found that challenge and related due-process claims forfeited. It also rejected an independent due-process theory because Sterlingov had not shown that limits on access materially impaired his defense.
The distinction between control and ownership predates the Reactor dispute. A 2013 Bitcoin clustering paper by Sarah Meiklejohn and colleagues warned that a wallet service can control addresses holding funds owned by different customers. The paper also described how change-address heuristics can create incorrect links. Those errors can merge unrelated clusters.
In 2025, the Ghost Clusters study compared Chainalysis attribution with seized-wallet data from BestMixer. It also examined data from Hansa Market and Wall Street Market. The study found conservative coverage and a small but nonzero number of false positives. Coverage varied by service and historical period. The study appeared after Sterlingov's 2024 trial.
Sterlingov's case differs from the German market-access dispute described in Bitcoin.de's licensing fight. His appeal concerned evidence in a U.S. criminal case. The German dispute concerned a MiCA license and service availability.
Chainalysis highlighted the D.C. Circuit's September 25 decision in its October 13 Daubert analysis, presenting the outcome as validation of Reactor. The court's holding was narrower: it rested on the testimony and record before it, along with Sterlingov's failure to explain why source code was necessary to his defense.
Under Rule 705, an expert may give an opinion without first listing its underlying facts or data unless the court orders otherwise. Those facts or data can be required on cross-examination.
